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UNITED STATES DISTRICT COURT FOR THE 
WESTERN DISTRICT OF WASHINGTON 
AT SEATTLE 


UNITED STATES OF AMERICA, 


NO. MJ19-0344 


Plaintiff 


v. 


UNITED STATES’ MEMORANDUM 
IN SUPPORT OF MOTION FOR 
DETENTION 


PAIGE A. THOMPSON, 

Defendant. 


The United States of America, by and through Brian T. Moran, United States 
Attorney for the Western District of Washington, and Andrew C. Friedman and Steven T. 
Masada, Assistant United States Attorneys for said District, files this memorandum in 
support of its motion to detain Defendant Paige A. Thompson pending resolution of this 
criminal matter. 


I. INTRODUCTION 


On July 29, 2019, Defendant Paige A. Thompson, also known by the online alias 
“erratic,” was arrested based on evidence that she had hacked into servers rented or 


contracted by Capital One Financial Corporation (“Capital One”) from a cloud 


computing company. The same day, she made her initial appearance in this Court, 


charged by complaint with Computer Fraud and Abuse, in violation of Title 18, United 
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States Code, Section 1030(a)(2). The United States filed a motion for pretrial detention. 
That hearing, at the defense’s request, was continued until August 15, 2019. 

The government understands that the United States Probation and Pretrial Services 
Office (“Pretrial Services”) is recommending that Thompson be detained. The 
government agrees with this recommendation. Thompson has a long history of 
threatening behavior that includes repeated threats to kill others, to kill herself, and to 
commit suicide by cop. Thompson’s threats have resulted in multiple calls to law 
enforcement, and the entry of protection orders against Thompson. Thompson’s crime in 
this case - major cyber intrusions that resulted in the theft of massive amounts of data 
from what now appears to be more than 30 victim companies - only exacerbates the harm 
that Thompson has done, and the threat she would pose if released. As a result, the Court 
should order Thompson detained, both as a danger to the community, and as a risk of 
non-appearance. 

II. BACKGROUND 
A. Thompson’s Background 

Thompson has a long history of threatening and violent behavior - including 
threats to kill others and herself, and to commit suicide by cop - that has resulted in 
multiple calls to law enforcement, and the entry of protection orders against Thompson. 

■ In October 2018, two individuals, a couple, sought protection orders 
against Thompson. As set forth in a police report and their petitions, 
attached as Exhibits 1, 2, and 3, Thompson harassed and stalked the 
couple over the course of seven years (from 2011 through 2018). The 
harassment, which included leaving notes and personal items at the 
petitioners’ residence, repeatedly contacting them through social 
media (including through newly-created accounts after the victims 
blocked earlier accounts), and sending what the victims felt were 
threatening text messages and emails, was so severe that it contributed 
to the couple moving. The King County District Court entered 
protection orders, attached as Exhibit 4 and 5, in favor of both the wife 
and husband, each for a term of five years, with the possibility of 
renewal for an additional term. 
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■ In March 2019, police were called to Thompson’s residence after 
Thompson became violent with her housemates. According to the 
police report, attached as Exhibit 6, Thompson had become agitated. 
When a housemate tried to intervene, Thompson tried to strike the 
housemate. Notably, Thompson’s housemates reported that 
Thompson had threatened to retrieve a fake gun in the house and use it 
to commit “suicide by cop.” Thompson’s housemates also stated that 
Thompson had a history during the entire time that she lived at the 
house of getting “incredibly angry at a moment’s notice and 
becoming] destructive to property and assaultive” to others. 

■ And, perhaps most concerning, in May 2019, police were called to 
Thompson’s residence after Thompson contacted an acquaintance at a 
California technology office, and threatened to travel to the company’s 
campus in California and to “shoot up” the office. According to the 
police report, attached as Exhibit 7, Thompson made this threat in a 
string of messages that concerned the friend enough that he reported it 
to the police. Significantly, at the time that she made this threat, 
Thompson had access to the weapons to commit such an act through 
her housemate - namely, the arsenal of assault rifles and other guns of 
her roommate, Park Quan (discussed further below). 

Thompson’s threats have continued, on social media in recent months. For 
example, in June 2019, Thompson conveyed her readiness to “check the f-ck out,” and 
said that she had “nothing to lose,” but that she was “taking [her] time to pick off a few 
that deserve to go down”: 
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ERRATIC 

@0xA3A97B6C 


lm ready to check the fuck out 

$ I dont care if its jail or death 

Jun 20, 2019, 9:57 AM 


Prefer to die , and something to make it easy 

$ Or you know jail 

Jun 20, 2019, 9:59 AM 


© I can settle for that 

Jun 20, 2019, 10:03 AM 


So someone i dont know, i have nothing to lose 


I mean im taking my time to pick off a few that deserve to go 
down but its going to come back to me sooner or later and 
thats part of the plan 



Not you, im just saying because you asked 


Jun 20, 2019, 10:07 AM 


Thompson also recently has threatened people who call law enforcement about her, as 
well as threatened to kill officers who respond to such calls: 



ERRATIC @0xA3A97B6C • 4m 
Replying to @0xA3A97B6C 

But not the bitch ass n^^|who call the 
cops "omg save this person from 
themselves" bitch fuck you ill shoot those 
pigs, and then im coming for you next, 
naaaaagh! 


Q i tl O dL 


In addition to this history of threats - and, perhaps, explaining in part the threats - 
Thompson appears to have significant mental-health issues. According to one of the 
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victims of Thompson’s harassment, Thompson has longstanding mental-health issues. 

See Exhibit 1. Indeed, Thompson herself has told others that she takes psychiatric 
medications. See Exhibit 7. 

Thompson also has been unemployed since 2016, has no known employment 
prospects if released, and, according to Thompson’s housemates, is not welcome back at 
her residence. 

B. Thompson’s Crime 

1. Thompson’s Theft of Capital One’s Data 

Thompson is charged with committing a massive data theft. Thompson was 
arrested for, and currently is charged with, intruding into servers rented or contracted by 
Capital One, and with stealing huge volumes of data from those servers. According to 
Capital One, Thompson stole information in credit card applications of approximately 
106 million people. Although some of the information (such as most Social Security 
numbers) was encrypted, other information, such as applicants’ names, addresses, dates 
of birth, and information about their credit history was not encrypted. Moreover, the data 
included unencrypted Social Security Numbers and bank account numbers for smaller 
numbers of customers (estimated at 120,000 of the former, and 77,000 of the latter, as of 
the date of Thompson’s arrest). 

The evidence that Thompson committed this crime is overwhelming. It includes 
forensic evidence linking Thompson to the data theft, which resulted in this Court’s 
issuance of a warrant to search Thompson’s residence. It includes the fact that the 
government recovered data stolen from Capital One on a server recovered from 
Thompson’s bedroom. And, it includes the fact that Thompson admitted to agents on the 
morning of the search that she had committed this intrusion. 

Thompson’s crime has done massive harm to Capital One. Capital One already is 
the subject of 40 lawsuits in the United States, and eight more lawsuits in Canada. 

Capital One has announced that it expects the incident to result in costs of between $100 
and 150 million in 2019. See https://www.wsi.com/articles/capital-one-reports-data- 
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breach-11564443355 (dated July 30, 2019). (According to some estimates, the company 
might ultimately face significantly more exposure. See, e.g., 

https://fortune.com/2019/07/3 l/capital-one-data-breach-2019-paige-thompson-settlement 

(dated July 31, 2019) (estimating costs of up to $500 million).) And, the company’s 
stock price has dropped approximately 10% since the breach was announced, erasing 
billions of dollars from the company’s market capitalization. 

2. Thompson’s Theft of Other Company’s Data 

The government’s investigation over the last two weeks has revealed that 
Thompson’s theft of Capital One’s data was only one part of her criminal conduct. The 
servers seized from Thompson’s bedroom during the search of Thompson’s residence, 
include not only data stolen from Capital One, but also multiple terabytes of data stolen 
by Thompson from more than 30 other companies, educational institutions, and other 
entities. That data varies significantly in both type and amount. For example, much of 
the data appears not to be data containing personal identifying information. At this point, 
however, the government is continuing to work to identify specific entities from which 
data was stolen, as well as the type of data stolen from each entity. The government 
expects to add an additional charge against Thompson based upon each such theft of data, 
as the victims are identified and notified. 

The government notes that Thompson has represented that she neither sold, nor 
otherwise shared or disseminated any of the data that she stole (from Capital One or any 
other victim), and that the copy of the data that the government recovered during the 
search of Thompson’s residence is the only copy of the stolen data that she created. It is 
too early to confirm that this is the case. The government is continuing its investigation, 
which will take a significant amount of time and resources, given the immense amount of 
forensic evidence to review. To date, however, the government has not uncovered any 
evidence that would suggest Thompson’s statement that she neither sold, nor otherwise 
disseminated, any of the data beyond the servers that the government recovered is untrue. 
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3. Other Evidence Recovered from Thompson’s Residence. 

Although Thompson’s residence originally was searched pursuant to a warrant 
seeking evidence of Thompson’s cybercrimes, during the course of searching the 
residence, agents found additional evidence relevant to the issue of Thompson’s 
detention. Specifically, within the bedroom of Thompson’s roommate, Park Quan, 
agents observed what can fairly be described as an arsenal of weapons, ammunition, and 
explosive material, largely unsecured and accessible to his housemates, including 
Thompson. Because Quan is a convicted felon, and not allowed to possess firearms, 
agents obtained a follow-on search warrant to seize firearms and related items. 

Pursuant to that warrant, agents seized 14 firearms, including assault rifles, a 
sniper rifle, and hand guns. Some of the guns were loaded, including one with a high- 
capacity magazine. At least one appears to be short-barreled. Also recovered were two 
bump stocks, which are designed to be attached to semiautomatic firearms in place of 
conventional stocks, enabling them to fire bullets more rapidly, mimicking a fully- 
automatic weapon, two 37 mm “flare launchers,” which can be used to shoot a variety of 
projectiles, and multiple high-capacity magazines. The fact that all of these weapons 
were recovered in the bedroom adjacent to Thompson, most of them readily accessible to 
her, is obviously of concern, given Thompson’s recurrent threats to commit violence 
against herself and others. 

III. DISCUSSION 

Thompson poses both a significant danger to the community and a risk of 
nonappearance. Pretrial Services has indicated that it will recommend detention for 
Thompson. The government agrees Thompson should be detained. 

A. The Legal Standard 

18 U.S.C. § 3142(f)(2)(A) provides that the court shall “hold a hearing to 
determine whether any condition or combination of conditions . . . will reasonably assure 
the appearance of [a defendant] and the safety of any other person and the community” 
upon motion of the government in any “case that involves ... a serious risk that such 
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person will flee.” If Thompson were released, there is a serious risk that she would fail to 
appear for future proceedings, both because she might flee, and because she might follow 
through on her repeated threats to harm herself (particularly now that she is facing 
criminal prosecution and a substantial term of imprisonment). 

At a detention hearing, 18 U.S.C. § 3142(g) provides that the court 
shall. . . take into account 

(1) the nature and circumstances of the offense charged; 

(2) the weight of the evidence against the person; 

(3) the history and characteristics of the person . . . and 

(4) the nature and seriousness of the danger to any person or the 
community that would be posed by the person’s release .... 

B. Thompson Should be Detained as a Danger 

Each and every one of § 3142(g) factors counsels strongly for detention in 
Thompson’s case. First, the nature and circumstances of the offense with which 
Thompson is charged are tremendously serious. Thompson is charged with committing 
one of the largest cyber intrusions and data thefts in history. (Although the Equifax 
breach reportedly involved the theft of personal information of approximately 143 
million people, Thompson’s intrusion dwarfs most other famous breaches. For instance, 
the Target breach involved personal information of only approximately 41 million 
people.) According to Capital One, Thompson’s intrusion involved the theft of 
information of approximately 106 million customers. The threat or harm to those 
individuals is massive. 

And Capital One is only of the victims of Thompson’s criminal conduct. As noted 
above, the evidence recovered from Thompson’s residence suggests that Thompson 
intruded into servers operated, rented, or contracted by over 30 companies, educational 
institutions, and other entities. Although not all of those intrusions involved the theft of 
personal identifying information, it appears likely that a number of the intrusions did. 

Moreover, even if it is true that the government recovered all of the stolen data, 
the impact of Thompson’s crime will be immense. Capital One alone already has been 
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sued in 48 separate cases, has estimated that it will incur $100 to $150 million of 
additional costs in 2019, and presumably will incur even higher costs before the 
consequences of Thompson’s actions are fully resolved. Presumably, many of the other 
victims of Thompson’s intrusions and thefts also will incur substantial costs. 

Second, the weight of the evidence is overwhelming. Thompson openly boasted 
about her exploits on various social media forums. 

Ive basically strapped myself with a bomb vest, fucking 
dropping capitol ones dox and admitting it 

I wanna distribute those buckets i think first 

Jun 18, 2019,12:04 AM 

There ssns...with full name and dob 

Jun 18, 2019,12:06 AM 


$ 


Data that Thompson stole from Capital One, and other victims, was recovered from a 
server in Thompson’s bedroom. And, in a post-arrest statement, Thompson admitted to 
the data intrusion and theft of data from entities, including Capital One. 

Third, Thompson’s history and characteristics further weigh in favor of detention. 
Thompson has a long history of threats to kill others, to kill herself, and to commit 
suicide by cop. The threats are serious enough that they have resulted in multiple calls to 
law enforcement and restraining orders. The threats likely are related to, and intertwined 
with, what appears to be a significant history of mental health problems. In addition, 
Thompson lacks both a residence to which she could be released and employment to 
provide her structure and stability. 

Finally, Thompson’s release would pose an extremely serious danger to the 
community. It would pose such a danger on multiple levels. First, Thompson would 
pose a danger of violence. After repeated threats to kill others or herself, or to commit 
suicide by cop, Thompson clearly poses a physical danger. In today’s America, it is easy 
enough to obtain firearms, and there is every reason to be concerned that Thompson, who 
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repeatedly has threatened to kill, would obtain the means to carry out, and carry out, her 
threats - particularly when confronted with the alternative of near-certain conviction and 
imprisonment. 

Second, Thompson would pose a technological danger. Thompson’s conduct 
already almost certainly has caused hundreds of millions of dollars of damage. If 
Thompson were released, if she does in fact have another copy of the stolen data, 
Thompson could sell or disseminate it. And, even if she does not have another copy, 
Thompson’s technical sophistication means that she could commit additional cyber 
intrusions, thereby likely causing additional hundreds of millions of dollars of damage. 
Both risks are of particular concern given Thompson’s instability. Regardless of what 
Thompson might promise the Court, she previously has threatened to disseminate stolen 
data containing tens of millions of people’s personal identifying information. See, e.g., 
Twitter Post on page 9 (threatening to “distribute [Capital One’s] buckets”). There are no 
reasonable assurances that she would not follow through on such a threat in the future. 

The government presumes that Thompson’s counsel will argue that, if released, 
Thompson would be under appropriate mental-health care, thereby mitigating the risk of 
releasing Thompson. But, Thompson’s mental-health conditions are long-standing and 
well-known to Thompson. And Thompson made the threats and committed the crimes 
that counsel against her release, even while apparently receiving mental-health treatment. 
There is no reason to believe that any mental-health treatment that Thompson might 
receive while on release would be any more effective in reducing the danger that 
Thompson would pose than her prior treatment. 

Simply put, if Thompson is released, there is every reason to believe that 
Thompson would resort to threats, violence, or cybercrime. And, if Thompson were 
inclined to resort to violence, or to conduct future cyber intrusions, no condition or 
combination of conditions could adequately prevent her from doing so. 
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C. Risk of Flight 

In addition to being a danger, Thompson also poses a risk of nonappearance. She 
has a history of mental-health issues and of severely erratic and bizarre (and often 
violent) behavior, despite her participation in treatment programs. Thompson can offer 
no sound rationale why she would fair differently under court-imposed conditions. 
Indeed, Thompson now faces very serious charges, overwhelming evidence, and a 
significant sentence. The immense added stress caused by her current circumstances 
presumably will only serve to intensify the unpredictability of her future actions. 

Moreover, the risk that Thompson would flee, or otherwise fail to appear, cannot 
be adequately addressed by court-imposed conditions of release. As courts repeatedly 
have recognized, electronic monitoring has many uses, but it does not prevent flight. See, 
e.g., United States v. Townsend , 897 F.2d 989, 994-95 (9 th Cir. 1990) (“Nor does the 
wearing of an electronic device offer assurance against flight occurring before measures 
can be taken to prevent a detected departure from the jurisdiction.”) And there is no way 
of ensuring that Thompson, who repeatedly has threatened to kill herself (including, 
tangentially, at her initial appearance), and who so far has offered no solution to address 
her recent history of such threats, would not, in fact, harm herself. 

Like danger to others and the community, these concerns of nonappearance are 
further aggravated by Thompson’s lack of employment and stable residence. Put simply, 
Thompson’s risk of nonappearance further counsels for detention. 

// 

// 

// 
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IV. CONCLUSION 

In short, every one of the § 3142(g) factors weighs heavily in favor of detention. 
No conditions that the Court can impose adequately could protect the community or 
ensure Thompson’s appearance at future proceedings. As a result, the Court should order 
Thompson detained. 

DATED this 13 th day of August, 2019. 


Respectfully submitted, 

BRIAN T. MORAN 
United States Attorney 

// s // Andrew C. Friedman 
// s // Steven T. Masada 


ANDREW C. FRIEDMAN 
STEVEN T. MASADA 
Assistant United States Attorneys 

United States Attorney’s Office, 

700 Stewart Street, Suite 5220 
Seattle, Washington 98101-1271 
Telephone: (206) 553-7970 
Facsimile: (206) 553-0882 

E-mail: Andrew.Friedman@usdoj .gov 

Steven. Masada@usdoj .gov 
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CERTIFICATE OF SERVICE 


I hereby certify that on August 13, 2019,1 electronically filed the foregoing with 
the Clerk of Court using the CM/ECF system which will send notification of such filing 
to the attorney of record for the defendant. 


// 5 // Andrew C. Friedman _ 

ANDREW C. FRIEDMAN 
Assistant United States Attorney 

United States Attorney’s Office 

700 Stewart, Suite 5220 

Seattle, Washington 98101-1271 

Telephone: (206) 553-2277 

Facsimile: (206) 553-0882 

E-mail: Andrew.Friedman@usdoi.gov 
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